A software company has implemented a security awareness program with annual training and phishing simulations. After a year, the click rate on simulated phishing emails has not decreased. Which action should the security team take to improve the program's effectiveness?

Replace the phishing simulations with a longer annual training video

Analyze simulation results to identify specific departments or behaviors that need targeted training

Increase the frequency of phishing simulations to weekly

Discontinue the simulations because they are not working

A company wants to promote a culture of security awareness among its employees. Which approach is most effective in fostering long-term engagement?

Make security awareness training an annual mandatory event

Create a security champions program where volunteers from each team receive extra training and promote security best practices

Send a weekly email with security tips

Reward employees who report phishing emails with gift cards

A multinational corporation develops software for both government and commercial clients. They need a security framework that can satisfy strict government requirements while also being flexible enough for commercial products. Which approach is most appropriate?

Adopt a single comprehensive framework like NIST SP 800-53 for all projects

Use a risk-based approach, applying different frameworks based on each project's regulatory and contractual requirements

Adopt ISO/IEC 27001 and require all projects to be certified

Implement the OWASP Top 10 for all projects and ignore other frameworks

A security team has implemented a security awareness program and wants to ensure it stays relevant as the company grows. Which action is most important for continuous improvement?

Increase the frequency of training sessions without changing content

Keep the program the same to avoid confusion

Focus on compliance with training completion rates

Regularly review and update the program based on new threats and feedback from employees

A software company wants to promote security awareness among its developers. Which initiative is most likely to be effective in changing developer behavior?

Post security reminders in the team chat channel

Provide a monthly security newsletter with tips and recent incidents

Integrate security training into the developer onboarding process and provide regular hands-on workshops

Require developers to complete a one-time online security course

Certified Secure Software Lifecycle Professional

Domain 2Objective 2

Identify and Adopt Security Standards (e.g., Implementing Security Frameworks, Promoting Security Awareness) CSSLP Practice Questions (Page 4)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

5concepts

11%of the exam

Questions 16–20

16application · medium
A software company has implemented a security awareness program with annual training and phishing simulations. After a year, the click rate on simulated phishing emails has not decreased. Which action should the security team take to improve the program's effectiveness?
Select an answer first
17application · medium
A company wants to promote a culture of security awareness among its employees. Which approach is most effective in fostering long-term engagement?
Select an answer first
18expert · hard
A multinational corporation develops software for both government and commercial clients. They need a security framework that can satisfy strict government requirements while also being flexible enough for commercial products. Which approach is most appropriate?
Select an answer first
19application · medium
A security team has implemented a security awareness program and wants to ensure it stays relevant as the company grows. Which action is most important for continuous improvement?
Select an answer first
20application · medium
A software company wants to promote security awareness among its developers. Which initiative is most likely to be effective in changing developer behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.